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The MIPS R4000 processor provides a full-featured memory management 
unit (MMU) which uses an on-chip translation lookaside buffer (TLB) to 
translate virtual addresses into physical addresses. 

This chapter describes the processor virtual and physical address spaces, 
the virtual-to-physical address translation, the operation of the TLB in 
making these translations, and those System Control Coprocessor (CPO) 
registers that provide the software interface to the TLB. 
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4.1 Translation Lookaside Buffer (TLB) 

Mapped virtual addresses are translated into physical addresses using an 
on-chip TLB^ The TLB is a fully associative memory that holds 48 entries, 
which provide mapping to 48 odd/even page pairs (96 pages). When 
address mapping is indicated, each TLB entry is checked simultaneously 
for a match with the virtual address that is extended with an ASID stored 
in the EntryHi register. 

The address mapped to a page ranges in size from 4 Kbytes to 16 Mbytes, 
in multiples of 4— that is. 4K. 16K, 64K, 256K, IM. 4M. 16M. 



Hits and Misses 

If there is a virtual address match, or hit, in the TLB. the physical page 
number is extracted from the TLB and concatenated with the offset to form 
the physical address (see Figure 4-1). 

If no match occurs (TLB miss), an exception is taken and software refills 
the TLB from the page table resident in memory. Software can write over 
a selected TLB entry or use a hardware mechanism to write into a random 
entry. 

Multiple Matches 

If more than one entry in the TLB matches the virtual address being 
■ translated, the operation is undefined. To prevent permanent damage to 

the part, the TLB may be disabled if more than several entries match. The 
TLB-Shutdown (TS) bit in the Status register is set to 1 if the TLB is 
disabled. 



t There are virtual-to-physical address translations that occur outside of the TLB. For 
example addresses in the ksegO and ksegl spaces are unmapped translations. In these 
spaces the physical address is derived by subtracting the base address of the space from 
the virtual address. 
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4.2 Address Spaces 

This section describes the virtual and physical address spaces and the 
manner in which virtual addresses are converted or "translated" into 
physical addresses in the TLB. 

Virtual Address Space 

The processor virtual address can be either 32 or 64 bits wide, 1 " depending 
on whether the processor is operating in 32-bit or 64-bit mode. 

• In 32-bit mode, addresses are 32 bits wide. The maximum user 
process size is 2 gigabytes (2 31 ). 

• In 64-bit mode, addresses are 64 bits wide. The maximum user 
process size is 1 terabyte (2 40 ). 

Figure 4-1 shows the translation of a virtual address into a physical 
address. 



1 . Virtual address (VA) represented by the 
virtual page number (VPN) is compared 
with tag in TLB. 



If there is a match, the page frame 
number (PFN) representing the upper 
bits of the physical address (PA) is 
output from the TLB. 



Virtual address 



3. The Offset, which does not pass through 
the TLB, is then concatenated to the PFN. 




Physical address 

Figure 4-1 Overview of a Virtual-to-Physical Address Translation 



t Figure 4-8 shows the 32-bit and 64-bit versions of the processor TLB entry. 
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As shown in Figures 4-2 and 4-3, the virtual address is extended with an 
8-bit address space identifier (ASID), which reduces the frequency of TLB 
flushing when switching contexts. This 8-bit ASID is in the CPO EntryHi 
register, described later in this chapter. The Global bit (G) is in the EntryLoO 
and EntryLol registers, described later in this chapter. 

Physical Address Space 

Using a 36-bit address, the processor physical address space encompasses 
64 gigabytes. The section following describes the translation of a virtual 
address to a physical address. 

Virtual-to-Physical Address Translation 

Converting a virtual address to a physical address begins by comparing 
the virtual address from the processor with the virtual addresses in the 
TLB; there is a match when the virtual page number (VPN) of the address 
is the same as the VPN field of the entry, and either: 

• the Global (G) bit of the TLB entry is set. or 

• the ASID field of the virtual address is the same as the ASID 
field of the TLB entry. 

This match is referred to as a TLB hit If there is no match, a TLB Miss 
exception is taken by the processor and software is allowed to refill the 
TLB from a page table of virtual/physical addresses in memory. 

If there is a virtual address match in the TLB. the physical address is 
output from the TLB and concatenated with the Offset which represents 
an address within the page frame space. The Offset does not pass through 
the TLB. 

Virtual-to-physical translation is described in greater detail throughout 
the remainder of this chapter; Figure 4-20 is a flow diagram of the process 
shown at the end of this chapter. 

The next two sections describe the 32-bit and 64-bit address translations. 
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32-bit Mode Address Translation 

Figure 4-2 shows the virtual-to-physical-address translation of a 32-bit 
mode address. 

♦ The top portion of Figure 4-2 shows a virtual address with a 
12-bit, or 4-Kbyte, page size, labelled Offset The remaining 20 
bits of the address represent the VPN, and index the lM-entry 
page table, 

• The bottom portion of Figure 4-2 shows a virtual address with 
a 24-bit, or 16-Mbyte, page size, labelled Offset The remaining 
8 bits of the address represent the VPN, and index the 256- 
entry page table. 



39 



Virtual Address with 1M (2 20 ) 4-Kbyte pages 

32 31 29 28 20 bits = 1M pages 12 11 



ASID 




VPN 



Offset 



20 





Virtual-to-physical 
translation in TLB 



Bits 31 , 30 and 29 of the virtual 
address select user, supervisor, 
or kernel address spaces. 



TLB 



36-bit Physical Address f 
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unchanged to 
physical 
memory 
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Offset | 



Virtual-to-physical f 
translation in TLB 



TlbI — 
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physical 
memory 



24 23 
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ASID 



VPN 



Offset 



8 



8 bits 



8 

* 256 pages 



24 



Virtual Address with 256 (2 e )16-Mbyte pages 



Figure 4-2 32-bit Mode Virtual Address Translation 
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64-bit Mode Address Translation 

Figure 4-3 shows the virtual-to-physical-address translation of a 64-bit 
mode address. This figure illustrates the two extremes in the range of 
possible page sizes: a 4-Kbyte page (12 bits) and a 16-Mbyte page (24 bits). 

• The top portion of Figure 4-3 shows a virtual address with a 
12-bit, or 4-Kbyte, page size, labelled Offset The remaining 28 
bits of the address represent the VPN, and index the 256M- 
entry page table. 

• The bottom portion of Figure 4-3 shows a virtual address with 
a 24-bit, or 16-Mbyte, page size, labelled Offset. The remaining 
16 bits of the address represent the VPN, and index the 64K- 
entry page table. 
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Operating Modes 

The processor has three operating modes that function in both 32- and 64- 
bit operations: 

User mode 

Supervisor mode 

• Kernel mode 

These modes are described in the next three sections. 

User Mode Operations 

In User mode, a single, uniform virtual address space— labelled User 
segment — is available; its size is: 

• 2 Gbytes (2 31 bytes) in 32-bit mode (useg) 

• 1 Tbyte (2 40 bytes) in 64-bit mode (xuseg) 
Figure 4-4 shows User mode virtual address space. 



Ox FFFF FFFF 



Ox 8000 0000 



Ox 0000 0000 



32-bif 



64-bit 



Address 
Error 



2 GB 
Mapped 



useg 



Ox FFFF FFFF FFFF FFFF 



Ox 0000 0100 0000 0000 



Ox 0000 0000 0000 0000 




xuseg 



Figure 4-4 User Mode Virtual Address Space 

•NOTE: The R4000 uses 64-bit addresses internally. When the kernel 
is running in Kernel mode, it initializes registers before switching 
modes, and saves (or restores, whichever is appropriate) register 
values on context switches. In 32-bit mode, a valid address must be a 
32-bit signed number, where bits 63:32 » bit 31. In normal operation 
it is not possible for a 32-bit User-mode program to produce invalid 
addresses, However, although it would be an error, it is possible for a 
Kernel-mode program to erroneously place a value that is not a 32-bit 
signed number into a 64-bit register, in which case the User-mode 
program generates an invalid address. 
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The User segment starts at address 0 and the current active user process 
resides in either useg (in 32-bit mode) or xuseg (in 64-bit mode). The TLB 
identically maps all references to useg/ xuseg from all modes, and controls 
cache accessibility.* 

The processor operates in User mode when the Status register contains the 
following bit- values: 
. KSUbits=10 2 

• EXL = 0 

• ERL = 0 

In conjunction with these bits, the UXbit in the Status register selects 
between 32- or 64-bit User mode addressing as follows: 

• when UX - 0, 32-bit useg space is selected and TLB misses are 
handled by the 32-bit TLB refill exception handler 

• when UX= 1, 64-bit xuseg space is selected and TLB misses are 
handled by the 64-bit XTLB refill exception handler 

Table 4-1 lists the characteristics of the two user mode segments, useg and 
xuseg. 

Table 4-1 32-bit and 64-bit User Mode Segments 



Address Bit 
Values 


Status Register 
Bit Values 


Segment 
Name 


Address Range 


Segment Size 


KSU 


EXT. 


FRT, 


ux 








32-bit 
A(31) = 0 


10 2 


0 


0 


0 


useg 


0x0000 0000 

through 
0x7FFF FFFF 


2 Gbyte 
(2 31 bytes) 


64-bit 
A(63:40) = 0 


10 2 


0 


0 


1 


xuseg 


0x0000 0000 0000 0000 

through 
0x0000 00FF FFFF FFFF 


1 Tbyte 
(2 40 bytes) 



t The cached (Q field in a TLB entry determines whether the reference is cached: see Figure 
4-8. 
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32-bit User Mode (useg) 

In User mode, when UX = 0 in the Status register, User mode addressing 
is compatible with the 32-bit addressing model shown in Figure 4-4, and a 
2-Gbyte user address space is available, labelled useg. 

All valid User mode virtual addresses have their most-significant bit 
cleared to 0; any attempt to reference an address with the most-significant 
bit set while in User mode causes an Address Error exception. 

The system maps all references to useg through the TLB, and bit settings 
within the TLB entry for the page determine the cacheability of a reference. 

64-bit User Mode {xuseg) 

In User mode, when UX=1 in the Status register, User mode addressing is 
extended to the 64-bit model shown in Figure 4-4. In 64-bit User mode, the 
processor provides a single, uniform address space of 2 40 bytes, labelled 
xuseg. 

All valid User mode virtual addresses have bits 63:40 equal to 0; an 
attempt to reference an address with bits 63:40 not equal to 0 causes an 
Address Error exception. 

Supervisor Mode Operations 

Supervisor mode is designed for layered operating systems in which a 
true kernel runs in R4000 Kernel mode, and the rest of the operating 
system runs in Supervisor mode. 

The processor operates in Supervisor mode when the Status register 
contains the following bit- values: 

• KSU* 01 2 

• EXL = 0 

• ERL = 0 

In conjunction with these bits, the SXbit in the Status register selects 
between 32- or 64-bit Supervisor mode addressing: 

• when SX = 0, 32-bit supervisor space is selected and TLB 
misses are handled by the 32-bit TLB refill exception handler 

• when SX= 1, 64-bit supervisor space is selected and TLB 
misses are handled by the 64-bit XTLB refill exception handler 
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Figure 4-5 shows Supervisor mode address mapping. Table 4-2 lists the 
characteristics of the supervisor mode segments; descriptions of the 
address spaces follow. 



Qx FFFF FFFF 
Qx B000 0000 

OX CO 00 0000 

Qx AO00 0000 

OX 8000 0000 



Qx 0000 0000 



32-bit* 



64-bit 



Address 
error 



0.5 GB 
Mapped 



Address 
error 



Address 
error 



2 GB 
Mapped 



sseg 



suseg 



Ox FFFF FFFF FFFF FFFF 
Qx FFFF FFFF EO00 0000 

Qx FFFF FFFF C000 0000 

QX 4000 0100 0000 0000 

Qx 4000 0000 0000 0000 

Ox 0000 0100 0000 0000 

Qx 0000 0000 0000 0000 



Address 
error 



0.5 GB 
Mapped 



Address 
error 



1 TB 
Mapped 



Address 
error 



1 TB 
Mapped 



csseg 



xsseg 



xsuseg 



Figure 4-5 Supervisor Mode Address Space 

•NOTE: The R4000 uses 64-bit addresses internally. In 32-bit mode, 
a valid address must be a 32-bit signed number, where bits 63:32 = bit 
31, In normal operation it is not possible for a 32-bit Supervisor-mode 
program to create an invalid address through arithmetic operations. 
However 32-bit-mode Supervisor programs must not create addresses 
using base register+offset calculations that produce a 32-bit 2's- 
complement overflow; in specific, there are two prohibited cases: 

offset with bit 15 = 0 and base register with bit 31 = 0, but {base 
register+offset) bit 31 » 1 
• offset with bit 15 = 1 and base register with bit 31 = 1, but (base 
register+offset) bit 31 = 0 

Using this invalid address produces an undefined result. 
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Table 4-2 32-bit and 64-bit Supervisor Mode Segments 




Address Bit 
Values 


Status Register 
Bit Values 


Segment 
Name 


Address Range 


Segment 
Size 




KSU 


F.XI. 


F.KT. 


sx 








32-bit 
A(31)-0 


01 2 


0 


0 


0 


suseg 


0x0000 0000 

through 
0x7FFF FFFF 


2 Gbytes 
(2 01 bytes) 


32-bit 
A(31:29) = 110 2 


01 2 


0 


0 


0 


ssseg 


OxCOOO 0000 

through 
OxDFFF FFFF 


512 Mbytes 
(2 29 bytes) 


64-bit 
A(63:62) - 00 2 


01 2 


0 


0 


1 


xsuseg 


0x0000 0000 0000 0000 

through 
0x0000 00FF FFFF FFFF 


1 Tbyte 
(2 40 bytes) 


64-bit 
A(63:62) - 01 2 


01 2 


0 


0 


1 


xsseg 


0x4000 0000 0000 0000 

through 
0x4000 00FF FFFF FFFF 


1 Tbyte 
(2 40 bytes) 


64-bit 
A(63:62) = 11 2 


01 2 


0 


0 


1 


csseg 


OxFFFF FFFF C00O 0000 

through 
OxFFFF FFFFDFFF FFFF 


512 Mbytes 
(2 29 bytes) 



32-bit Supervisor Mode, User Space (suse^ 

In Supervisor mode, when SX = 0 in the Status register and the most- 
significant bit of the 32-bit virtual address is set to 0, the suseg virtual 
address space is selected; it covers the full 2 31 bytes (2 Gbytes) of the 
current user address space. The virtual address is extended with the 
contents of the 8-bit ASID field to form a unique virtual address. 
This mapped space starts at virtual address 0x0000 0000 and runs through 
0x7FFF FFFF. 

32-bit Supervisor Mode, Supervisor Space (sseg) 

In Supervisor mode, when SX= 0 in the Status register and the three most- 
sienificant bits of the 32-bit virtual address are 110 2 . the sseg virtual 
address space is selected; it covers 2 29 -bytes (512 Mbytes) of the current 
supervisor address space. The virtual address is extended with the 
contents of the 8-bit ASID field to form a unique virtual address. 
This mapped space begins at virtual address OxCOOO 0000 and runs 
through OxDFFF FFFF. 
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64-bit Supervisor Mode, User Space (xsuseg) 

In Supervisor mode, when SX= 1 in the Status register and bits 63:62 of the 
virtual address are set to 00 2 , the xsuseg virtual address space is selected; 
it covers the full 2 40 bytes (1 Tbyte) of the current user address space. The 
virtual address is extended with the contents of the 8-bit ASID field to 
form a unique virtual address. 

This mapped space starts at virtual address 0x0000 0000 0000 0000 and 
runs through 0x0000 00FF FFFF FFFF. 

64-bit Supervisor Mode, Current Supervisor Space (xsseg) 

In Supervisor mode, when SX« 1 in the Status register and bits 63:62 of the 
virtual address are set to 01 2 , the xsseg current supervisor virtual address 
space is selected. The virtual address is extended with the contents of the 
8-bit ASID field to form a unique virtual address. 

This mapped space begins at virtual address 0x4000 0000 0000 0000 and 
runs through 0x4000 0OFF FFFF FFFF. 

64-bit Supervisor Mode, Separate Supervisor Space (csseg) 

In Supervisor mode, when SX= 1 in the Status register and bits 63:62 of the 
virtual address are set to 1 12. the csseg separate supervisor virtual address 
space is selected. Addressing of the csseg is compatible with addressing 
sseg in 32-bit mode. The virtual address is extended with the contents of 
the 8-bit ASID field to form a unique virtual address. 

This mapped space begins at virtual address OxFFFF FFFF C000 0000 and 
runs through OxFFFF FFFF DFFF FFFF. 
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Kernel Mode Operations 

The processor operates in Kernel mode when the Status register contains 
one of the following values: 

• JCSU=00 2 
. EXL - 1 

. ERL= 1 

In conjunction with these bits, the KXbit in the Status register selects 
between 32- or 64-bit Kernel mode addressing: 

• when KX = 0, 32-bit kernel space is selected and all TLB misses 
are handled by the 32-bit TLB refill exception handler 

• when KX = 1. 64-bit kernel space is selected and all TLB misses 
are handled by the 64-bit XTLB refill exception handler 

The processor enters Kernel mode whenever an exception is detected and 
it remains in Kernel mode until an Exception Return (ERET) instruction is 
executed. The ERET instruction restores the processor to the mode 
existing prior to the exception. 

Kernel mode virtual address space is divided into regions differentiated 
by the high-order bits of the virtual address, as shown in Figure 4-6. Table 
4-3 lists the characteristics of the 32-bit kernel mode segments, and Table 
4-4 lists the characteristics of the 64-bit kernel mode segments. 
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32-bit* 



64-bit 



Ox FFFF FFFF 
Ox EOOO 0000 

Ox COOO 0000 

Ox AOOO 0000 

Ox 8000 0000 



Ox 0000 0000 



0.5 GB 
Mapped 



0.5 GB 
Mapped 



0.5 GB 
Unmapped 
Uncached 



0.5 GB 
Unmapped 
Cached 



2 GB 
Mapped 



kseg3 



ksseg 



ksegl 
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Ox FFFF FFFF FFFF FFFF 
Ox FFFF FFFF EOOO 0000 

Qx FFFF FFFF COOO 0000 
Ox FFFF FFFF AOOO 0000 
Ox FFFF FFFF 8000 0000 
Ox COOO OOFF 8000 0000 
Ox COOO 0000 0000 0000 
Ox 8000 0000 0000 0000 
Ox 4000 0100 0000 0000 

Ox 4000 0000 0000 0000 
Ox 0000 0100 0000 0000 

Ox 0000 0000 0000 0000 




xkuseg 



Figure 4-6 Kernel Mode Address Space 

♦NOTE: The R4000 uses 64-bit addresses internally. In 32-bit mode, 
a valid address must be a 32-bit signed number, where bits 63:32 = bit 
31; an invalid address produces an undefined result. In 32-bit mode, 
a Kernel-mode program may use 64-bit instructions, but must not 
create addresses using base register+offset calculations that produce a 
32-bit 2's-complement overflow; in specific, there are two prohibited 
cases: 

• offset with bit 15 = 0 and base register with bit 31 = 0, but (base 
register+offset) bit 31 = 1 

• offset with bit 15 = 1 and base register with bit 31 = 1, but (base 
register+offset) bit 31 = 0 
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Table 4-3 32-bit Kernel Mode Segments 



Address Bit 
Values 


Status Register 
Is One Of These 
Values 


Segment 
Name 


Address Range 


Segment 
Size 


KSU EXL ERL 


KX 


A(31)-0 


KSU = 00 2 
or 
EXL=1 

or 
ERL =1 


0 


kuseg 


0x0000 0000 

tnrougn 
0x7FFF EFFF 


2 Gbytes 
(2 31 bytes) 


A(31:29) = 100 2 


0 


ksegO 


0x8000 0000 

through 
0x9FFF FFFF 


512 Mbytes 
(2 29 bytes) 


A(31:29) = 101 2 


0 


ksegl 


OxAOOO 0000 

through 
OxBFFF FFFF 


512 Mbytes 
(2 29 bytes) 


A(31:29) = 110 2 


0 


ksseg 


j OxCOOO 0000 

through 
| OxDFFFFFFF 


512 Mbytes 
(2 29 bytes) 


A(31:29) = 111 2 


0 


kseg3 


OxEOOOOOOO 

through 
OxFFFF FFFF 


512 Mbytes 
(2 29 bytes) 



32-bit Kernel Mode, User Space (kuseg) 

In Kernel mode, when KX= 0 in the Status register, and the most- 
significant bit of the virtual address, A31, is cleared, the 32-bit kuseg virtual 
address space is selected; it covers the full 2 31 bytes (2 Gbytes) of the 
current user address space. The virtual address is extended with the 
contents of the 8-bit ASID field to form a unique virtual address. 

When ERL = 1 in the Status register, the user address region becomes a 
2 31 -byte unmapped (that is, mapped directly to physical addresses) 
uncached address space. See the Cache Error exception in Chapter 5 for 
more information. 

32-bit Kernel Mode, Kernel Space 0 (ksegO) 

In Kernel mode, when KX= 0 in the Status register and the most- 
significant three bits of the virtual address are 100 2 , 32-bit ksegO virtual 
address space is selected; it is the 2 29 -byte (512-Mbyte) kernel physical 
space. References to ksegO are not mapped through the TLB; the physical 
address selected is defined by subtracting 0x8000 0000 from the virtual 
address. The KO field of the ConTig register, described in this chapter, 
controls cacheability and coherency. 
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32-bit Kernel Mode, Kernel Space 1 (ksegl) 

In Kernel mode, when KX= 0 in the Status register and the most- 
significant three bits of the 32-bit virtual address are 101 2 . 32-bit ksegl 
virtual address space is selected; it is the 2 29 -byte (512-Mbyte) kernel 
physical space. 

References to ksegl are not mapped through the TLB; the physical address 
selected is defined by subtracting OxAOOO 0000 from the virtual address. 

Caches are disabled for accesses to these addresses, and physical memory 
(or memory-mapped I/O device registers) are accessed directly. 

32-bit Kernel Mode, Supervisor Space (ksseg) 

In Kernel mode, when KX =* 0 in the Status register and the most- 
significant three bits of the 32-bit virtual address are 110 2 , the ksseg virtual 
address space is selected; it is the current 2 29 -byte (512-Mbyte) supervisor 
virtual space. The virtual address is extended with the contents of the 8- 
bit ASID field to form a unique virtual address. 

32-bit Kernel Mode, Kernel Space 3 (ksegS) 

In Kernel mode, when KX= 0 in the Status register and the most- 
significant three bits of the 32-bit virtual address are 11 1 2 . the kseg3 virtual 
address space is selected; it is the current 2 29 -byte (512-Mbyte) kernel 
virtual space. The virtual address is extended with the contents of the 8-bit 
ASID field to form a unique virtual address. 
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Table 4-4 64-bit Kernel Mode Segments 



Address Bit 
Values 


Status Register 
Is One Of These 
Values 


Segment 
Name 


Address Range 


Segment 
Size 




KSU EXL ERL 


KX 


A(63:62) = 00 2 


KSU « 00 2 
or 
EXL=1 

or 
ERL =1 


1 


xksuseg 


0x0000 0000 0000 0000 

uirougn 
0x0000 00FF FFFF FFFF 


1 Tbyte 
(2 40 bytes) 


A(63:62) = 01 2 


1 


xksseg 


0x4000 0000 0000 0000 

tnrougn 
0x4000 00FF FFFF FFFF 


1 Tbyte 
(2 40 bytes) 


A(63:62) - 10 2 


1 


xkphys 


0x8000 0000 0000 0000 

through 
OxBFFF FFFF FFFF FFFF 


8 2 36 -byte 
spaces 




1 


xkseg 


OxCOOO 0000 0000 0000 

through 
OxCOOO 00FF 7FFF FFFF 


(2 40 -2 31 ) 
! Dyres 


A(63:62) = 11 2 
A(61:31)»-l 


1 


cksegO 


OxFFFF FFFF 8000 0000 

through 
OxFFFF FFFF 9FFFFFFF 


512Mbytes 
(2 29 bytes) 


A(63:62) = 11 2 
A(61:31)--l 


1 


cksegl 


OxFFFF FFFF A000 0000 

through 
OxFFFF FFFF BFFF FFFF 


512 Mbytes 
(2 29 bytes) 


A(63:62) = 11 2 
A(61:31) = -l 


1 


cksseg 


OxFFFF FFFF C000 0000 

through 
OxFFFF FFFF DFFF FFFF 


512 Mbytes 
(2 29 bytes) 


A(63:62) = 11 2 
A(61:31) = -l 


1 


ckseg3 


OxFFFF FFFF E000 0000 

through 
OxFFFF FFFF FFFF FFFF 


5 12 Mbytes 
(2 29 bytes) | 



64-bit Kernel Mode, User Space (xkuseg) 

In Kernel mode, when KX= 1 in the Status register and bits 63:62 of the 64- 
bit virtual address are 00 2 . the xkuseg virtual address space is selected; it 
covers the current user address space. The virtual address is extended 
with the contents of the 8-bit ASID field to form a unique virtual address. 

31 

When ERL = 1 in the Status register, the user address region becomes a 2 - 
byte unmapped (that is. mapped directly to physical addresses) uncached 
address space. See the Cache Error exception in Chapter 5 for more 
information. 
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64-bit Kernel Mode, Current Supervisor Space (xksseg) 
In Kernel mode, when KX= 1 in the Status register and bits 63:62 of the 64- 
bit virtual address are 01 2 . the xksseg virtual address space is selected; it is 
the current supervisor virtual space. The virtual address is extended with 
the contents of the 8-bit ASID field to form a unique virtual address. 

64-bit Kernel Mode. Physical Spaces (xkphys) 

In Kernel mode, when KX = 1 in the Status register and bits 63:62 of the 64- 
bit virtual address are 10 z . the xkphys virtual address space is selected; it is 
a set of eight 2 35 -byte kernel physical spaces. Accesses with address bits 
58:36 not equal to 0 cause an address error. 

References to this space are not mapped; the physical address selected is 
taken from bits 35:0 of the virtual address. Bits 61:59 of the virtual address 
specify the cacheability and coherency attributes, as shown in Table 4-5. 

Table 4-5 Cacheability and Coherency Attributes 



Value (61:59) 

r o 
l 


Cacheability and Coherency Attributes 

Reserved 

Reserved 


Starting Address 
0x8000 0000 0000 0000 
0x8800 0000 0000 0000 


2 


Uncached 


0x9000 0000 0000 0000 


3 


Cacheable, noncoherent 


0x9800 0000 0000 0000 


4 


Cacheable, coherent exclusive 


OxAOOO 0000 0000 0000 


5 


Cacheable, coherent exclusive on write 


0xA800 0000 0000 0000 


6 


Cacheable, coherent update on write 


OxBOOO 0000 0000 0000 


7 


Reserved 


0xB800 0000 0000 0000 ] 
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64-bit Kernel Mode, Kernel Space (xkseg) 

In Kernel mode, when KX - 1 in the Status register and bits 63:62 of the 64- 
bit virtual address are 1 1 2 , the address space selected is one of the 
following: 

• kernel virtual space, xkseg, the current kernel virtual space; the 
virtual address is extended with the contents of the 8-bit ASID 
field to form a unique virtual address 

one of the four 32-bit kernel compatibility spaces, as described 
in the next section. 

64-bit Kernel Mode, Compatibility Spaces (cksegl:0, cksseg, ckseg3) 

In Kernel mode, when KX= 1 in the Status register, bits 63:62 of the 64-bit 
virtual address are 11 2 , and bits 61:31 of the virtual address equal -1, the 
lower two bytes of address, as shown in Figure 4-6, select one of the 
following 512-Mbyte compatibility spaces. 

cksegO. This 64-bit virtual address space is an unmapped 
region, compatible with the 32-bit address model ksegQ. The KO 
field of the ConUg register, described in this chapter, controls 
cacheability and coherency 

cksegl. This 64-bit virtual address space is an unmapped and 
uncached region, compatible with the 32-bit address model 
ksegl. 

cksseg. This 64-bit virtual address space is the current 
supervisor virtual space, compatible with the 32-bit address 
model ksseg. 

ckseg3. This 64-bit virtual address space is kernel virtual space, 
compatible with the 32-bit address. model kseg3. 
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4.3 System Control Coprocessor 

The System Control Coprocessor (CPO) is implemented as an integral part 
of the CPU, and supports memory management, address translation, 
exception handling, and other privileged operations. CPO contains the 
registers shown in Figure 4-7 plus a 48-entry TLB. The sections that follow 
describe how the processor uses the memory management-related 
registers*. 

Each CPO register has a unique number that identifies it; this number is 
referred to as the register number. For instance, the Page Mask register is 
register number 5. 





EntryLoO b 

2 I 


EntryHi 
10* 


EntryLol | 





47 



0 U 




Used with memory 
management system. 

•Register number 

Figure 4-7 CPO Registers and the TLB 



Used with exception 
processing. See 
Chapter 5 for details. 



t For a description of CPO data dependencies and hazards, please see Appendix F. 
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Format of a TLB Entry 

Figure 4-8 shows the TLB entry formats for both 32- and 64-bit modes. 
Each field of an entry has a corresponding field in the EntryHL EntryLoO. 
EntryLol, or PageMask registers, as shown in Figures 4-9 and 4-10; for 
example the Mask field of the TLB entry is also held in the PageMask 
register. 



128-bit TLB 
entry in 32- , 
bit mode of i 
R4000 
processor 



127 



95 



121 120 



32-bit Mode 

109 108 



96 



MASK 



12 



VPN2 



19 



13 



77 



16 



75 72 71 



64 



ASID 
8 



38 37 35 34 33 32 



0 


PFN 


C | 


D 


V 


°l 


2 

31 30 29 


24 


6 


3 

5 3 


1 

2 


1 

1 


1 

0 




r PFN 


c 


D 


V 


4 


2 








3 


1 


1 


1 



255 



191 190 189 



256-bit TLB 
entry in 64- j 
bit mode of \ 
R4000 
processor 



64-bit Mode 

217 216 



205 204 



192 



MASK 



2 

127 



63 



22 



34 



0 
"IT 



39 
168 167 



12 

141 140139136135 



0 



128 



VPN2 



27 



94 93 



PFN 



24 



30 29 



PFN 



24 



Figure 4-8 Format of a TLB Entry 
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The format of the EntryHi. EntryLoO, EntryLol, and PageMask registers are 
nearly the same as the TLB entry. The one exception is the Global field 
(G bit), which is used in the TLB, but is reserved in the EntryHi register. 
Figures 4-9 and 4-10 describe the TLB entry fields shown in Figure 4-8. 

PageMask Register 0 

31 25 24 13 12 _ ^ 

32-bit | ~ r MASK J 2 I 

Mode I S 1 3 13 

Mask Page comparison mask. 

0 Reserved. Must be written as zeroes, and returns zeroes when read. 



3J EntryHi Register 

32-bit I VPN2 I 0 | ASID 
Mode I 1— S 

63 62 61 40 39 13 12 87 

64 " bit [r I FILL l~" VPN2 I 0 I ASID 
Mode l_J 1 1 § 

VPN2 Virtual page number divided by two (maps to two pages). 

Address space ID field. An 8-bit field that lets multiple processes share the TLB; 
"" each process has a distinct mapping of otherwise identical virtual page numbers. 

R Region. (00 -> user, 01 -» supervisor, 11 -* kernel) used to match vAddr 63 .. 62 

Fill Reserved. 0 on read; ignored on write. 

0..".."..... Reserved. Must be written as zeroes, and returns zeroes when read. 



3 



Figure 4-9 Fields of the PageMask and EntryHi Registers 
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EntryLoO and EntryLol Registers 



3 2 10 




32-bit 
Mode 



32-bit 
Mode 



64-bit 
Mode 



64-bit 

Mode i 34 24~ 

PFN Page frame number; the upper bits of the physical address. 
r qnecifies the TLB page coherency attribute; see Table 4-6. 

% IK ^ tWs bit is St? the page is" marked as dirty and, ther efore. writa ble This bit is 

° Sly a write-protect bit that software can use to preven alteration of data. 

„ vSS If thTs 3t is set, it indicates that the TLB entry is valid; otherw.se, a TLBL or TLBS 

q bit is set in both LOO and Lo1, then the processor ignores the ASID during 

0 ReL^edl^ust be written as zeroes, and returns zeroes when read. 

Figure 4-10 Fields of the EntryLoO and EntryLol Registers 
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The TLB page coherency attribute (Q bits specify whether references to 
the page should be cached: if cached, the algorithm selects between several 
coherency attributes. Table 4-6 shows the coherency attributes selected by 
the Cbits. 



TaWe 4-6 TLB Page Coherency (C) Bit Values 



C(5:3) Value 


Page Coherency Attribute 


0 


Reserved 


1 


Reserved 


2 


Uncached 


3 


Cacheable noncoherent (noncoherent) 


4 


Cacheable coherent exclusive (exclusive) 


5 


Cacheable coherent exclusive on write (sharable) 


6 


Cacheable coherent update on write (update) 


7 


Reserved 



CPO Registers 

The following sections describe the CPO registers, shown in Figure 4-7, 
that are assigned specifically as a software interface with memory 
management (each register is followed by its register number in 
parentheses). 

• Index register (CPO register number 0) 
Random register (1) 

• EntryLoO (2) and EntryLol (3) registers 

• PageMask register (5) 

• Wired register (6) 

• EntryHi register (10) 

• PRId register (15) 

• Config register (16) 

• LLAddr register (17) 

• TagLo (28) and TagHi (29) registers 
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Index Register (0) 

The Index register is a 32-bit, read/write register containing six bits to 
index an entry in the TLB. The high-order bit of the register shows the 
success or failure of a TLB Probe (TLBP) instruction. 

The Index register also specifies the TLB entry affected by TLB Read 
(TLBR) or TLB Write Index (TLBWI) instructions. 

Figure 4-11 shows the format of the Index register; Table 4-7 describes the 
Index register fields. 



31 30 



Index Register 



6 5 



Index 



25 



Figure 4- 11 Index Register 



Table 4- 7 Index Register Field Descriptions 



Field 


Description 


P 


Probe failure. Set to 1 when the previous TLBProbe 
(TLBP) instruction was unsuccessful. 


Index 


Index to the TLB entry affected by the TLBRead and 1 
TLBWrite instructions 


0 


Reserved. Must be written as zeroes, and returns zeroes 
when read. 



MIPS R4000 Microprocessor User's Manual 



85 



Random Register (1) 

The Random register is a read-only register of which six bits index an entry 
in the TLB. This register decrements as each instruction executes, and its 
values range between an upper and a lower bound, as follows: 

. A lower bound is set by the number of TLB entries reserved for 
exclusive use by the operating system (the contents of the 
Wired register) . 

. An upper bound is set by the total number of TLB entries (47 
maximum). 

The Random register specifies the entry in the TLB that is affected by the 
TLB Write Random instruction. The register does not need to be read for 
this purpose; however, the register is readable to verify proper operation 
of the processor. 

To simplify testing, the Random register is set to the value of the upper 
bound upon system reset. This register is also set to the upper bound 
when the Wired register is written. 

Figure 4-12 shows the format of the Random register; Table 4-8 describes 
the Random register fields. 



Random Register 

31 6 -A 



Random 



26 

Figure 4-12 Random Register 



Table 4-8 Random Register Field Descriptions 



Field 


Description 


Random 


TLB Random index 


0 


Reserved. Must be written as zeroes, and returns zeroes 
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EntiyLoO (2), and EntryLol (3) Registers 

The EntryLo register consists of two registers that have identical formats: 

* EntryLoO is used for even virtual pages. 

• EntryLol is used for odd virtual pages. 

The EntryLoO and EntryLol registers are read/write registers. They hold 
the physical page frame number (PFN) of the TLB entry for even and odd 
pages, respectively, when performing TLB read and write operations. 
Figure 4-10 shows the format of these registers. 

PageMask Register (5) 

The PageMask register is a read/write register used for reading from or 
writing to the TLB; it holds a comparison mask that sets the variable page 
size for each TLB entry, as shown in Table 4-9. 

TLB read and write operations use this register as either a source or a 
destination; when virtual addresses are presented for translation into 
physical address, the corresponding bits in the TLB identify which virtual 
address bits among bits 24:13 are used in the comparison. When the Mask 
field is not one of the values shown in Table 4-9, the operation of the TLB 
is undefined. 



Table 4-9 Mask Field Values for Page Sizes 



Page Size 


Bit 






24 


23 


22 


21 


20 


19 


18 


17 


16 


15 


14 


13 


4 Kbytes 


0 


0, 


. 0 


0 


0 


0 


0 


. o 


0 


0 


0 


0 


16 Kbytes 


0 


0 


0 


o. 


0 


0 


o 


0 


o 


0 


1 




64 Kbytes 


0 


0 


0 


0 


0 


0 


0 . 


.0 






1 




256 Kbytes 


0 


0 


0 


o 


0 


0 


1 


1 






1 




1 Mbyte 


0 


0 


0 


0 


1 


1 


1 


1 






1 




4 Mbytes 


0 


0. 


1 


1 


1 


1 


1 


1 






1 




16 Mbytes 


1 


1 


1 


1 


1 


1 


1 


1 




1 
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Wired Register (6) 

The Wired register is a read/write register that specifies the boundary 
between the wired and random entries of the TLB as shown in Figure 4-13. 
Wired entries are fixed, nonreplaceable entries, which cannot be 
overwritten by a TLB write operation. Random entries can be overwritten. 



TLB 



Range of Wired entries 





47 - 


! 






Range of Random entries 






\ ■ 

Wired , ., T 






Register 




0 





Figure 4-13 Wired Register Boundary 

The Wired register is set to 0 upon system reset. Writing this register also 
sets the Random register to the value of its upper bound (see Random 
register, above). Figure 4-14 shows the format of the Wired register; Table 
4-10 describes the register fields. 



Wired Register 



31 



6 5 



Wired 
6 



26 



Figure 4-14 Wired Register 



Table 4-10 Wired Register Field Descriptions 



Field 


Description 1 


Wired 


TLB Wired boundary 


0 


Reserved. Must be written as zeroes, and returns 
zeroes when read. 
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EntryHi Register (CPO Register 10) 

The EntryHi register holds the high-order bits of a TLB entry for TLB read 
and write operations. 

The EntryHi register is accessed by the TLB Probe, TLB Write Random, 
TLB Write Indexed, and TLB Read Indexed instructions. 

Figure 4-9 shows the format of this register. 

When either a TLB refill, TLB invalid, or TLB modified exception occurs, 
the EntryHi register is loaded with the virtual page number (VPN 2) and 
the ASID of the virtual address that did not have a matching TLB entry. 
(See Chapter 5 for more information about these exceptions.) 

Processor Revision Identifier (PRId) Register (15) 

The 32~bit, read-only Processor Revision Identifier {PRId) register contains 
information identifying the implementation and revision level of the CPU 
and CPO. Figure 4-15 shows the format of the PRId register; Table 4-11 
describes the PRId register fields. 



31 



PRId Register 

1615 



8 7 



Imp 



Rev 



16 8 8 

Figure 4-15 Processor Revision Identifier Register Format 



Table 4-1 1 PRId Register Fieids 



Field 


Description 


Imp 


Implementation number 


Rev 


Revision number 


0 


Reserved. Must be written as zeroes, and returns zeroes 
when read. 
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The low-order byte (bits 7:0) of the PRId register is interpreted as a revision 
number, and the high-order byte (bits 15:8) is interpreted as an 
implementation number. The implementation number of the R4000 
processor is 0x04. The content of the high-order halfword (bits 31:16) of 
the register are reserved. 

The revision number is stored as a value in the form y.x t where y is a major 
revision number in bits 7:4 and x is a minor revision number in bits 3:0. 

The revision number can distinguish some chip revisions, however there 
is no guarantee that changes to the chip will necessarily be reflected in the 
PRId register, or that changes to the revision number necessarily reflect 
real chip changes. For this reason, these values are not listed and software 
should not rely on the revision number in the PRId register to characterize 
the chip. 

Config Register (16) 

The Config register specifies various configuration options selected on 
R4000 processors; Table 4-12 lists these options. 

Some configuration options, as defined by Config bits 31:6. are set by the 
hardware during reset and are included in the Config register as read-only 
status bits for the software to access. Other configuration options are 
read/write (as indicated by ConRg register bits 5:0) and controlled by 
software; on reset these fields are undefined. 

Certain configurations have restrictions. The ConRg register should be 
initialized by software before caches are used. Caches should be written 
back to memory before line sizes are changed, and caches should be 
reinitialized after any change is made. 

Figure 4-16 shows the format of the ConRg register; Table 4-12 describes 
the ConRg register fields. 



Config Register 
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Figure 4-16 ConRg Register Format 
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Table 4-12 Config Register Fields 



Field 


Description 


CM 


Master-Checker Mode (1 -* Master/Checker Mode is enabled). 


EC 


System clock ratio: 

0 -» processor clock frequency divided by 2 

1 — » processor clock frequency divided by 3 
2 processor clock frequency divided by 4 

3 -> processor clock frequency divided by 6 (R4400 processor only 

4 -> processor clock frequency divided by 8 (R4400 processor only) 


EP 


Transmit data pattern (pattern for write-back data): 
n — * n Doubleword every cycle 

1 DDx 2 Doublewords every 3 cycles 

2 DDxx 2 Doublewords every 4 cycles 

3 -> DxDx 2 Doublewords every 4 cycles 

4 -> DDxxx 2 Doublewords every 5 cycles 

5 -> DDxxxx 2 Doublewords every 6 cycles 

6 ~> DxxDxx 2 Doublewords every 6 cycles 

7 — » DDxxxxxx 2 Doublewords every 8 cycles 

8 -» DxxxDxxx 2 Doublewords every 8 cycles 


SB 


Secondary Cache line size: 

0 — > 4 words 

1 — » 8 words 

2 — » 16 words 

3 32 words 


SS 


Split Secondary Cache Mode 

0 instruction and data mixed in secondary cache (joint cache) 

1 -» instruction and data separated by SCAddr(17) 


SW 


Secondary Cache port width 

0 -» 128-bit data path to S-cache 

1 — > Reserved 


EW 


System Port width 
0 -» 64-bit 
1, 2, 3 -> Reserved 


SC 


Secondary Cache present 
0 -» S-cache present 
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Table 4-1 2 (cont.) ConRg Register Fields 



Field Name 


Description 


SM 


Dirty Shared coherency state 

0 -» Dirty Shared coherency state is enabled 

1 -» Dirty Shared state is disabled 


BE 


BigEndianMem 

0 -* kernel and memory are little endian 

1 kernel and memory are Dig enaian 


EM 


ECC mode enable 

0 -* ECC mode enabled 

1 parity mode enabled 


EB 


Block ordering 

0 — > sequential 

1 — » sub-block 


0 


Reserved. Must be written as zeroes, returns zeroes when read. 


IC 


Primary I-cache Size (I-cache size = 2 12+I ° bytes). In the R4000 processor, 
this is set to 8 Kbytes; in the R4400 processor, this is set to 16 Kbytes. 


DC 


Primary D-cache Size (D-cache size = 2 12 + DC bytes) . In the R4000 processor, 
this is set to 8 Kbytes, in the R4400 processor,, this is set to 16 Kbytes. 


IB 


Primary I-cache line size 

0 -> 16 bytes 

1 -+ 32 bytes 


DB 


Primary D-cache line size 

0 -+16 bytes 

1 -> 32 bytes 


CU 


Update on Store Conditional 

0 Store Conditional uses coherency algorithm specified by TLB 

1 SC uses cacheable coherent update on write 


KO 


" ksegO coherency algorithm (see EntryLoO and EntryLol registers and the C 
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Load Linked Address (LLAddr) Register (17) 

The read/write Load Linked Address {LLAddr) register contains the physical 
address read by the most recent Load Linked instruction. 
This register is for diagnostic purposes only, and sen/es no function 
during normal operation. 

Figure 4-17 shows the format of the LLAddr register; PAddr represents bits 
of the physical address, PA(35:4). 

LLAddr Register 



PAddr(35:4) 

32 

Figure 4-1 7 LLAddr Register Format 



Cache Tag Registers [TagLo (28) and TagHi (29)] 

The TagLo and TagHi registers are 32-bit read/write registers that hold 
either the primary cache tag and parity, or the secondary cache tag and 
ECC during cache initialization, cache diagnostics, or cache error 
processing. The Tag registers are written by the CACHE and MTCO 
instructions. 

The Pand ECC fields of these registers are ignored on Index Store Tag 
operations. Parity and ECC are computed by the store operation. 

Figure 4-18 shows the format of these registers for primary cache 
operations. Figure 4-19 shows the format of these registers for secondary 
cache operations. 

Table 4-13 lists the field definitions of the TagLo and TagHi registers. 
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Figure 4-18 TagLo and TagHi Register (P-cache) Formats 
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Figure 4-19 TagLo and TagHi Register (S-cache) Formats 
Table 4- J 3 Cache Tag Register Fields 



Field 


Description f 


PTagLo 


Specifies the physical address bits 35:12 


PState 


Specifies the primary cache state 


P 


Specifies the primary tag even parity bit 


STagLo 


Specifies the physical address bits 35:17 


SState 


Specifies the secondary cache state 


Vlndex 


Specifies the virtual index of the associated Primary cache line. 
vAddr(14:12) 


ECC 


ECC for the STag, SState, and Vlndex fields f 


0 


Reserved. Must be written as zeroes, and returns zeroes when read. 


Undefined 


The TagHi register should not be used. 
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Virtual-to-Physical Address Translation Process 

During virtual-to-physical address translation, the CPU compares the 
8-bit ASID (if the Global bit. G, is not set) of the virtual address to the ASID 
of the TLB entry to see if there is a match. One of the following 
comparisons are also made: 

• In 32-bit mode, the highest 7-to-19 bits (depending upon the 
page size) of the virtual address are compared to the contents 
of the TLB virtual page number. 

• In 64-bit mode, the highest 15-to-27 bits (depending upon the 
page size) of the virtual address are compared to the contents 
of the TLB virtual page number. 

If a TLB entry matches, the physical address and access control bits (C, D, 
and V) are retrieved from the matching TLB entry. While the Vbit of the 
entry must be set for a valid translation to take place, it is not involved in 
the determination of a matching TLB entry. 

Figure 4-20 illustrates the TLB address translation process. 
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Virtual Address (Input) 




/ Access \ / Access \ 

Physical Address (Output) 

Figure 4-20 TLB Address Translation 
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TLB Misses 



If there is no TLB entry that matches the virtual address, a TLB miss 
exception occurs.* If the access control bits (Dand V) indicate that the 
access is not valid, a TLB modification or TLB invalid exception occurs. If 
the Cbits equal 010 2 . the physical address that is retrieved accesses main 
memory, bypassing the cache. 



TLB Instructions 



Table 4-14 lists the instructions that the CPU provides for working with 
the TLB. See Appendix A for a detailed description of these instructions. 

TaWe 4-1 4 TLB Instructions 



Op Code 


Description of Instruction 


TLBP 


Translation Lookaside Buffer Probe 


TLBR 


Translation Lookaside Buffer Read 


TLBWI 


Translation Lookaside Buffer Write Index 


TLBWR 


Translation Lookaside Buffer Write Random 



t TLB miss exceptions are described in Chapter 5. 
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